feat(capture): add source/destination IP filtering to network captures

[carlotaarvela]

Description

Adds the ability to filter packet captures by source and/or destination IP address, on both Linux and Windows nodes.

• New CaptureOption.SourceIPs / CaptureOption.DestinationIPs fields ([]string, max 100 entries each) on the Capture CRD.
• New kubectl retina capture create --source-ip / --destination-ip flags (comma-separated IP lists), validated client-side against valid IP literals to prevent filter/flag injection.
• On Linux, the IPs are translated into a BPF clause (src host ... / dst host ...) and combined with any user-supplied --pcap-filter via and.
• On Windows, the IPs are translated into the equivalent netsh trace SourceAddress/DestinationAddress filter groups and combined with the existing pod-IP-based filter.
• When both source and destination IPs are set, a packet must match at least one source IP and at least one destination IP to be captured.
• Added a guard rejecting the combination of the deprecated --tcpdump-filter flag with --source-ip/--destination-ip, since the two don't currently compose (use --pcap-filter instead).
• Updated CRD manifests (retina.sh_captures.yaml), generated deepcopy code, and CLI/CRD docs with examples.

Related Issue

Checklist

• I have read the contributing documentation.
• I signed and signed-off the commits (git commit -S -s ...). See this documentation on signing commits.
• I have correctly attributed the author(s) of the code.
• I have tested the changes locally.
• I have followed the project's style guidelines.
• I have updated the documentation, if necessary.
• I have added tests, if applicable.

Screenshots (if applicable) or Testing Completed

• Added unit tests covering: BPF/netsh filter construction (single/multiple/mixed IPv4+IPv6/invalid IP handling), combination with pod-IP filters and --pcap-filter, the new --tcpdump-filter incompatibility guard, and CLI CRD-population behavior.
• Ran go test ./pkg/capture/... ./cli/... — all passing.
• Manually validated end-to-end on an AKS cluster with source/destination pods and observed captures correctly scoped to the specified IPs.

Additional Notes

SourceIPs/DestinationIPs are only combinable with --pcap-filter, not the deprecated --tcpdump-filter; the CLI now returns a clear error if both are supplied together.

[Copilot]

Pull request overview

Adds source/destination IP filtering for Linux and Windows captures.

Changes:

• Adds CRD fields and CLI flags for IP filtering.
• Generates BPF and netsh filter expressions.
• Adds documentation and unit tests.

Reviewed changes

Copilot reviewed 9 out of 10 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
pkg/capture/crd_to_job.go	Builds Linux and Windows filters.
pkg/capture/crd_to_job_test.go	Tests filter translation and job rendering.
docs/04-Captures/03-crd.md	Documents CRD usage.
docs/04-Captures/02-cli.md	Documents CLI flags.
deploy/standard/manifests/controller/helm/retina/crds/retina.sh_captures.yaml	Extends the CRD schema.
crd/api/v1alpha1/zz_generated.deepcopy.go	Deep-copies new fields.
crd/api/v1alpha1/capture_types.go	Defines source/destination IP fields.
cli/cmd/capture/create.go	Parses and validates CLI flags.
cli/cmd/capture/create_test.go	Tests CLI behavior.
cli/cmd/capture/capture.go	Adds options and errors.

Files not reviewed (1)

• crd/api/v1alpha1/zz_generated.deepcopy.go: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Retina Code Coverage Report

Total coverage increased from 36.5% to 36.8% ✅

Increased diff

Impacted Files	Coverage
cli/cmd/capture/create.go	68.55% ... 79.65% (11.1%)	⬆️
pkg/capture/crd_to_job.go	84.08% ... 89.56% (5.48%)	⬆️
pkg/controllers/operator/retinaendpoint/retinaendpoint_controller.go	82.25% ... 83.28% (1.03%)	⬆️

[Alex Castilio (alexcastilio)]

LGTM